The authentication code reads the length to be checked from sender input,
this allows the sender to supply single byte HMAC code and have a 1 in 256
chance of matching the correct HMAC and authenticating, as only the first
byte will be checked. The sender would need to know a valid username.

Currently Net-SNMP and UCD-SNMP are known to be vulnerable, other SNMP
implementations may also be affected. The eCos project includes code derived
from UCD-SNMP and is therefore also affected.